workbook 122 ./ (run file) Use ./ to run a file executable
1 16 "Know Thy Systems" The idea that we can only secure what we know we own (or have)
Network access control lists specify which traffic flows are allowed or
2 18 (N)ACLs blocked between the different segments on your network
Contains special device files tha tprograms running on the system
use to communicate with physical hardware devices controlled by the
6 22 /dev directory OS kernel
Where disk partitions, their mount points, and the optiosn applied to
6 23 /etc/fstab each partition are stored
Misc. N/A /usr/bin & /usr/sbin/ directories Contains programs provided witht he operating system
Where most of the critical components of the OS live, including
system binaries, programming libraries and tools, and online
6 22 /usr directory documentation. Not changed after boot unless in upgrades or such
Misc. N/A /usr/local directory Contains third-party software from the internet
Where the system keeps frequently changing data, such as log files
6 22 /var directory and temporary queues for system services. Ex: email and printing
4 96 192.168.x.x Private network
The handshake that facilitates a TCP session comprising of SYN,
1 85 3 way handshake ACK, and SYN/ACK
After b, a and g promised better range and bandwidth with
1 175 802.11a and 802.11g maximums of 54 Mbps
In 2016, ac allows for a minimum of 1 Gbps in a multilink, with a
1 179 802.11ac minimum of 500 Mbps for single link
181- ax is focused on better efficiency, not better bandwidth for large
1 182 802.11ax (Higher Efficiency Amendment) connections of IoT devices. AKA the Higher Efficiency Amendment
The first true instantiation of 802.11, it supported 2.4 GHz
1 175 802.11b frequencies with a max bandwidth of 11 Mbps
1 196 802.11i Amendment focused on providing proper levels of security for WLAN
After b,a, and g, n offered higher bandwidth possibilitites through
1 177 802.11n Multiple Inpute Multiple Output (MIMO) and reflection
802.1X is a standard that allows for an authentication to occur prior to
1 43 802.1X a user and/or computing device being granted access to a network
Requires single or multi factor authentication. Success requires
possesion of the authenticator. Provides some assurance that the
2 56 AAL1 claimant is who they are
Requires proof of 2 different authentication factors. Approved
cryptographic techniques required at AAL2 and above. Provides high
2 56 AAL2 confidence
requires hardware-based authenticator and an authenticator that
provides verifier impersonation resistance. Provides very high
2 56 AAL3 confidence
2 61 Access Control Controllng the access to resources, as well as managing this access
Ensuring that users keep out of parts of servers they are not
supposed to be in. Disabling directories, using default pages etc... on
3 146 Access Control need to know, access, and execute basis
Individual permissions in the DACL. If there are two permissions set
5 76 Access control entries (ACEs) to true and false, false takes precedence
5 24 Access control list (ACL) The list of persmissions based on user and group SID numbers
Role based access control (RBAC), Lattice-Based Access Control
2 65 Access control techniques (LBAC)
2 41 Access Management Policy to control who has access from where
An entity with administrative capabilities and access to billing and
Misc. N/A Account cost management
The account admin enrolls users, assigns authenticators, and
2 66 Account administration assigns authorizations
workbook 9 ACK or [S.] Acknowledge flag sent to allow connection
Sending Ack packets to different ports and checking for responses. If
4 143 Ack Scan a responses is not sent, then the ports are unfiltered
Used to acknowledge the next sequence number expected to be
1 85 Acknowledgment (ACK) recieved
A databse of user accounts and other information that otherwise
would have been in the local accounts databases of stanalone
5 24 Active directory (AD) computers
A GUI used to manage the users and groups in a domain. Enterprise
5 85 Active directory accounts and groups admins are more powerful than domain admins
Provides traditional domain controller services in Azure to one's
other VMs hosted in Azure for the sake of Kerberos, NTLM, group
5 197 Active Directory Domain Services (AADDS) policy, and LDAP.
5 99 Active directory permissions
workbook 24 Active FTP Data goes over TCP port 20 on the FTP server side
, Depending on the context or their request and the sensitivity of the
resource, the claimant will need to provide one or more
2 109 Adaptive authentication authenticators
Randomizes the address space for processors to assist in the
prevention of exploits that require the use of known address locations
6 75 Address Space Layout Randomization (ASLR) for particular functions
Called ADM/ADMX/ADML templates, they can only be imported into
GPOs, not directly applied to a machine. They can make more
5 132 Administrative Templates options appear inside GPOs for the take of managing registry values
Sandboxes, or isolates, a local application so it can't interact with
6 215 Advanced Application Shielding another application
6 66 Advanced Packaging Tool (APT) Linux package management tool
A red team excercise where the red team emulates how an
adversary operates, following the same tactis, tecnhiques, and
3 38 Adversary Emulation procedures, with specific objectives
4 70 AES Algorithm & basic functions Code for AES shown with different functions and their operations
5 83 AGULP Acronym for how privileges and permissions should be applied
workbook 30 Aircrack-ng C Cracking tool
workbook 29 Aircrack-ng lab 1.3
workbook 30 aireplay-ng Tool for injecting and replaying wireless frames
workbook 30 airmon-ng Identifies wireless cards supported on the system
workbook 30 airodump-ng Tool to capture wireless frames
If an algorithm is a group, then encrypting multiple times is the same
as encrypting once. If an algorithm is not a group, then encrypting
4 65 Algorithm groups multiple times strengthens security
A content delivery network (CDN) capability chich can be used to
6 166 Amazon CloudFront deliver web content to customers
A monitoring solution for AWS services as well as applications
6 152 Amazon CloudWatch running AWS
An authentication service that allows users to signup, sign in, and
access your web and mobile applications from an identity providor
6 142 Amazon Cognito through user tools
6 127 Anchore for docker
2 181 Android Security Features
3 195 Annual tasks
Based on evens for specific protocols and applications that are
4 156 Anomaly Analysis outside the typical operating conditions
A configuration management tool that allows for autmomated system
administration tasks related to installation, account setup,
6 112 Ansible configuration etc...
Inspects and filters every file of a system and looks for malicious
2 15 Anti malware software code patterns called virus signatures
Inspect all incoming traffic and will filter out any excessive network
2 14 Anti-DDoS packets
Control to prevent network addressing defined behind an interface
4 141 Anti-Spoofing from sourcing from another interface
Linux kernel module that is used to resstrict the capabilities of
6 72 AppArmor programs
HIPS feature that records behavior with the host in applications
specified and can detect unintended behavior. If malicious, it can
4 217 Application Behavior Monitoring block
Whenever a new process is started, it will check and only allow
2 15 Application control approved applications to run
Creates a list of authorized files and only allows those files to execute
on the system. List is cryptographically hashed. Whenever an
authorized file is launched, the hashes are checked to see if changes
4 205 Application Control were made.
Screens incoming packets while also keeping a set of rules for
4 200 Application control firewalls applications
Creating a secure application by the means of implementing
authentication mechanisms, writing overflow protections, performing
2 6 Application security input validation
Allows admins to define exactly which executables can and cannot
be run. Audit only mode to test new rules without actually blocking
5 150 AppLocker programs
workbook 74 AppLocker audit mode Evaluates all rules and events written to logs
workbook 73 AppLocker lab 2.3 Helps to perform application allowlisting and blocklisting
Based on a cryptographic rule enforcement on a cryptographic hash
workbook 74 AppLocker rules - File hash of the application or file.
The path condition sets up sallowlists and blocklists basedon an
applications location on the file system. Seen as least secure due to
workbook 74 AppLocker rules - Path running app from different file locations
, Condition that checks the publisher, filename, version, product name
workbook 74 AppLocker rules - Publisher before running. Most secure condition
1 40 Approaches to network design
Nation state actors who act under the authority of a specific
1 30 APT (Advanced Persistent Threat) government or military organization
4 20 Arbitrary Substitution Exchanging one character (or byte) for another using a map
Asymmetric encryption is slower and does not make sense for
multiple messages at one time. 2 keys are used, one for encryption
(public) and one for decryption(private). This removes the need for a
public shared key. Alice uses Bob's public key to encrypt the
message so that only Bob can decrypt it using his private key. Public
4 29 Asymmetric Encryption (public key crypto algo) key crypto algorithm
1 32 Attacks Against Routers
1 34 Attacks Against Switches
An access monitoring and accounting solution by Red Hat. Used for
6 99 Auditd logging and debugging of precesses
5 276 Audit Directory Service Access Required to log access to active directory objects
6 103 aureport Outputs a summary of events present in the audit logs
6 101 ausearch Tool that lets you look through auditd logs
A vulnerability that allows a user to access a site's content without
Misc. N/A Authentication Bypass` asking for a login
Provides message integrity, anti replay, and source authentication by
paying attention to the IP header. Adds authentication info to each IP
4 94 Authentication Header (AH) packet
Include look-up secrets, out of band devices, one-time password
2 79 Authentication types (OTP) Tokens, cryptographic devices
2 56 Authenticator Assurance Level (AAL) The authentication process can be split into 3 levels called AAL1, 2, 3
Automate defenses so tha torganizations can achieve reliable,
2 119 Automation scalable, and continuous measurements
Lets you trrace an executable upon execution to learn what system
6 101 autrace calls it makes
6 159 Availability Zones (Networking) Represents an isolated and physically seperate data center
The AWS command line interface (CLI) allows you to access and
manage AWS services and resources programmatically. Must
6 144 AWS CLI download first
A service that lets you create templates to define infrastructure as
6 168 AWS CloudFOrmation code
6 154 AWS CloudTrail Used for loggin of management plane and plane events
Continuously monitors and records service configuratiosn in order to
6 156 AWS Config provide a view on configuration changes over time
A security service that continuously monitors, analyzes and
processes VPC Flow Logs, CloudTrail Management Event logs, and
S3 data event logs, DNS logs, and AWS account access for
6 158 AWS Guard Duty malicious events
AWS allows for multi-factor authentication and identity federation.
Once a user is authenticated, they can access the resources on the
2 32 AWS IAM system that they have been authorized to
a serverless service that can be used to create and execute functions
Misc. N/A AWS Lambda without having to manage servers.
Allows customers to centrally manage their cryptographic keys for
6 173 AWS Key Management Service (KMS) over 70 AWS services
Data security and privacy service that uses machine learning and
6 169 AWS Macie pattern matching to discover and protect data in AWS
Allows you to manage and access your AWS cloud resources and
services via a web interface or mobile app. Ex: Billing, cost
6 143 AWS Management Console management, system health
6 164 AWS Network Firewall A highly available and managed firewall service
2 37 AWS network segmentation
Gives a comprehensive view of the security posture of an AWS
account by helping to perform security checks against industry
6 158 AWS Security Hub standards and best practices
6 165 AWS Shield DDoS protection service that safeguards applications running AWS
Protects applications and APIs against the most common web
6 165 AWS Web Application Firewall (WAF) exploits
6 136 AWS Well-Architected Framework
Microsofts colelction of global datacenters that are used to implement
5 192 Azure cloud-based services
A security feature used to restrict access to apps and data using
5 214 Azure conditional access custom rules you define
Azure uses an "IF-This-THEN-THAT" mechanism to allow admins to
2 31 Azure IAM tell the system what to do in certain condition
1 16 "Know Thy Systems" The idea that we can only secure what we know we own (or have)
Network access control lists specify which traffic flows are allowed or
2 18 (N)ACLs blocked between the different segments on your network
Contains special device files tha tprograms running on the system
use to communicate with physical hardware devices controlled by the
6 22 /dev directory OS kernel
Where disk partitions, their mount points, and the optiosn applied to
6 23 /etc/fstab each partition are stored
Misc. N/A /usr/bin & /usr/sbin/ directories Contains programs provided witht he operating system
Where most of the critical components of the OS live, including
system binaries, programming libraries and tools, and online
6 22 /usr directory documentation. Not changed after boot unless in upgrades or such
Misc. N/A /usr/local directory Contains third-party software from the internet
Where the system keeps frequently changing data, such as log files
6 22 /var directory and temporary queues for system services. Ex: email and printing
4 96 192.168.x.x Private network
The handshake that facilitates a TCP session comprising of SYN,
1 85 3 way handshake ACK, and SYN/ACK
After b, a and g promised better range and bandwidth with
1 175 802.11a and 802.11g maximums of 54 Mbps
In 2016, ac allows for a minimum of 1 Gbps in a multilink, with a
1 179 802.11ac minimum of 500 Mbps for single link
181- ax is focused on better efficiency, not better bandwidth for large
1 182 802.11ax (Higher Efficiency Amendment) connections of IoT devices. AKA the Higher Efficiency Amendment
The first true instantiation of 802.11, it supported 2.4 GHz
1 175 802.11b frequencies with a max bandwidth of 11 Mbps
1 196 802.11i Amendment focused on providing proper levels of security for WLAN
After b,a, and g, n offered higher bandwidth possibilitites through
1 177 802.11n Multiple Inpute Multiple Output (MIMO) and reflection
802.1X is a standard that allows for an authentication to occur prior to
1 43 802.1X a user and/or computing device being granted access to a network
Requires single or multi factor authentication. Success requires
possesion of the authenticator. Provides some assurance that the
2 56 AAL1 claimant is who they are
Requires proof of 2 different authentication factors. Approved
cryptographic techniques required at AAL2 and above. Provides high
2 56 AAL2 confidence
requires hardware-based authenticator and an authenticator that
provides verifier impersonation resistance. Provides very high
2 56 AAL3 confidence
2 61 Access Control Controllng the access to resources, as well as managing this access
Ensuring that users keep out of parts of servers they are not
supposed to be in. Disabling directories, using default pages etc... on
3 146 Access Control need to know, access, and execute basis
Individual permissions in the DACL. If there are two permissions set
5 76 Access control entries (ACEs) to true and false, false takes precedence
5 24 Access control list (ACL) The list of persmissions based on user and group SID numbers
Role based access control (RBAC), Lattice-Based Access Control
2 65 Access control techniques (LBAC)
2 41 Access Management Policy to control who has access from where
An entity with administrative capabilities and access to billing and
Misc. N/A Account cost management
The account admin enrolls users, assigns authenticators, and
2 66 Account administration assigns authorizations
workbook 9 ACK or [S.] Acknowledge flag sent to allow connection
Sending Ack packets to different ports and checking for responses. If
4 143 Ack Scan a responses is not sent, then the ports are unfiltered
Used to acknowledge the next sequence number expected to be
1 85 Acknowledgment (ACK) recieved
A databse of user accounts and other information that otherwise
would have been in the local accounts databases of stanalone
5 24 Active directory (AD) computers
A GUI used to manage the users and groups in a domain. Enterprise
5 85 Active directory accounts and groups admins are more powerful than domain admins
Provides traditional domain controller services in Azure to one's
other VMs hosted in Azure for the sake of Kerberos, NTLM, group
5 197 Active Directory Domain Services (AADDS) policy, and LDAP.
5 99 Active directory permissions
workbook 24 Active FTP Data goes over TCP port 20 on the FTP server side
, Depending on the context or their request and the sensitivity of the
resource, the claimant will need to provide one or more
2 109 Adaptive authentication authenticators
Randomizes the address space for processors to assist in the
prevention of exploits that require the use of known address locations
6 75 Address Space Layout Randomization (ASLR) for particular functions
Called ADM/ADMX/ADML templates, they can only be imported into
GPOs, not directly applied to a machine. They can make more
5 132 Administrative Templates options appear inside GPOs for the take of managing registry values
Sandboxes, or isolates, a local application so it can't interact with
6 215 Advanced Application Shielding another application
6 66 Advanced Packaging Tool (APT) Linux package management tool
A red team excercise where the red team emulates how an
adversary operates, following the same tactis, tecnhiques, and
3 38 Adversary Emulation procedures, with specific objectives
4 70 AES Algorithm & basic functions Code for AES shown with different functions and their operations
5 83 AGULP Acronym for how privileges and permissions should be applied
workbook 30 Aircrack-ng C Cracking tool
workbook 29 Aircrack-ng lab 1.3
workbook 30 aireplay-ng Tool for injecting and replaying wireless frames
workbook 30 airmon-ng Identifies wireless cards supported on the system
workbook 30 airodump-ng Tool to capture wireless frames
If an algorithm is a group, then encrypting multiple times is the same
as encrypting once. If an algorithm is not a group, then encrypting
4 65 Algorithm groups multiple times strengthens security
A content delivery network (CDN) capability chich can be used to
6 166 Amazon CloudFront deliver web content to customers
A monitoring solution for AWS services as well as applications
6 152 Amazon CloudWatch running AWS
An authentication service that allows users to signup, sign in, and
access your web and mobile applications from an identity providor
6 142 Amazon Cognito through user tools
6 127 Anchore for docker
2 181 Android Security Features
3 195 Annual tasks
Based on evens for specific protocols and applications that are
4 156 Anomaly Analysis outside the typical operating conditions
A configuration management tool that allows for autmomated system
administration tasks related to installation, account setup,
6 112 Ansible configuration etc...
Inspects and filters every file of a system and looks for malicious
2 15 Anti malware software code patterns called virus signatures
Inspect all incoming traffic and will filter out any excessive network
2 14 Anti-DDoS packets
Control to prevent network addressing defined behind an interface
4 141 Anti-Spoofing from sourcing from another interface
Linux kernel module that is used to resstrict the capabilities of
6 72 AppArmor programs
HIPS feature that records behavior with the host in applications
specified and can detect unintended behavior. If malicious, it can
4 217 Application Behavior Monitoring block
Whenever a new process is started, it will check and only allow
2 15 Application control approved applications to run
Creates a list of authorized files and only allows those files to execute
on the system. List is cryptographically hashed. Whenever an
authorized file is launched, the hashes are checked to see if changes
4 205 Application Control were made.
Screens incoming packets while also keeping a set of rules for
4 200 Application control firewalls applications
Creating a secure application by the means of implementing
authentication mechanisms, writing overflow protections, performing
2 6 Application security input validation
Allows admins to define exactly which executables can and cannot
be run. Audit only mode to test new rules without actually blocking
5 150 AppLocker programs
workbook 74 AppLocker audit mode Evaluates all rules and events written to logs
workbook 73 AppLocker lab 2.3 Helps to perform application allowlisting and blocklisting
Based on a cryptographic rule enforcement on a cryptographic hash
workbook 74 AppLocker rules - File hash of the application or file.
The path condition sets up sallowlists and blocklists basedon an
applications location on the file system. Seen as least secure due to
workbook 74 AppLocker rules - Path running app from different file locations
, Condition that checks the publisher, filename, version, product name
workbook 74 AppLocker rules - Publisher before running. Most secure condition
1 40 Approaches to network design
Nation state actors who act under the authority of a specific
1 30 APT (Advanced Persistent Threat) government or military organization
4 20 Arbitrary Substitution Exchanging one character (or byte) for another using a map
Asymmetric encryption is slower and does not make sense for
multiple messages at one time. 2 keys are used, one for encryption
(public) and one for decryption(private). This removes the need for a
public shared key. Alice uses Bob's public key to encrypt the
message so that only Bob can decrypt it using his private key. Public
4 29 Asymmetric Encryption (public key crypto algo) key crypto algorithm
1 32 Attacks Against Routers
1 34 Attacks Against Switches
An access monitoring and accounting solution by Red Hat. Used for
6 99 Auditd logging and debugging of precesses
5 276 Audit Directory Service Access Required to log access to active directory objects
6 103 aureport Outputs a summary of events present in the audit logs
6 101 ausearch Tool that lets you look through auditd logs
A vulnerability that allows a user to access a site's content without
Misc. N/A Authentication Bypass` asking for a login
Provides message integrity, anti replay, and source authentication by
paying attention to the IP header. Adds authentication info to each IP
4 94 Authentication Header (AH) packet
Include look-up secrets, out of band devices, one-time password
2 79 Authentication types (OTP) Tokens, cryptographic devices
2 56 Authenticator Assurance Level (AAL) The authentication process can be split into 3 levels called AAL1, 2, 3
Automate defenses so tha torganizations can achieve reliable,
2 119 Automation scalable, and continuous measurements
Lets you trrace an executable upon execution to learn what system
6 101 autrace calls it makes
6 159 Availability Zones (Networking) Represents an isolated and physically seperate data center
The AWS command line interface (CLI) allows you to access and
manage AWS services and resources programmatically. Must
6 144 AWS CLI download first
A service that lets you create templates to define infrastructure as
6 168 AWS CloudFOrmation code
6 154 AWS CloudTrail Used for loggin of management plane and plane events
Continuously monitors and records service configuratiosn in order to
6 156 AWS Config provide a view on configuration changes over time
A security service that continuously monitors, analyzes and
processes VPC Flow Logs, CloudTrail Management Event logs, and
S3 data event logs, DNS logs, and AWS account access for
6 158 AWS Guard Duty malicious events
AWS allows for multi-factor authentication and identity federation.
Once a user is authenticated, they can access the resources on the
2 32 AWS IAM system that they have been authorized to
a serverless service that can be used to create and execute functions
Misc. N/A AWS Lambda without having to manage servers.
Allows customers to centrally manage their cryptographic keys for
6 173 AWS Key Management Service (KMS) over 70 AWS services
Data security and privacy service that uses machine learning and
6 169 AWS Macie pattern matching to discover and protect data in AWS
Allows you to manage and access your AWS cloud resources and
services via a web interface or mobile app. Ex: Billing, cost
6 143 AWS Management Console management, system health
6 164 AWS Network Firewall A highly available and managed firewall service
2 37 AWS network segmentation
Gives a comprehensive view of the security posture of an AWS
account by helping to perform security checks against industry
6 158 AWS Security Hub standards and best practices
6 165 AWS Shield DDoS protection service that safeguards applications running AWS
Protects applications and APIs against the most common web
6 165 AWS Web Application Firewall (WAF) exploits
6 136 AWS Well-Architected Framework
Microsofts colelction of global datacenters that are used to implement
5 192 Azure cloud-based services
A security feature used to restrict access to apps and data using
5 214 Azure conditional access custom rules you define
Azure uses an "IF-This-THEN-THAT" mechanism to allow admins to
2 31 Azure IAM tell the system what to do in certain condition
